Security audit

Multi-Agent Governor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed multi-agent workflow governor with local helper scripts for manifests, hashes, capsules, and usage metrics; no hidden network, persistence, or destructive behavior was found.

Before installing, understand that this skill can direct your agent to spawn bounded subagents and run local helper scripts. Use it for tasks where parallel review or delegation is actually useful, and avoid pointing its hashing or usage scripts at broad private directories unless that is intentional.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose describes a coordinator for multi-agent or parallel task execution, including delegation management, QA limits, session waiting, freshness protection, and time/token reporting. The actual code chunk does not implement agent governance or parallel orchestration logic. Instead, it provides generic helper functions for file hashing, metadata collection, manifest reading, and atomic JSON writing. While artifact freshness protection could conceivably use hashing utilities as a supporting detail, this chunk’s primary behavior is materially different from the declared orchestration role and exposes undeclared filesystem/manifest capabilities. Therefore this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about governing multi-agent or parallel task execution. The supplied code does not implement any agent orchestration features, delegation, trigger handling, or reporting related to parallel work. Instead, it performs build/source artifact freshness verification by comparing file hashes from a manifest and signaling staleness via JSON output and exit status. While the description briefly mentions protecting artifact freshness, this script is only that narrow check and lacks the declared skill’s primary orchestration behavior, so the code’s actual purpose is materially different from the declared one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description is for a high-level orchestration/governance skill that manages multi-agent execution and parallel work. This code chunk does not govern agents or parallel execution. Its actual function is narrow and analytical: collect token usage statistics for threads associated with a manifest by querying a local SQLite database and parsing rollout log files. While the declaration mentions reporting actual time and token usage, that is only one small aspect of the broader declared purpose, and the code here lacks the central orchestration behaviors. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs use of local scripts, temp directories, manifests, hashing, and artifact updates, but it does not declare an explicit tool/permission scope. In a skill system, missing scope boundaries can lead to broader-than-expected file read/write access and make it harder for operators to evaluate what the skill is allowed to touch.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger conditions are very broad, including generic phrases like 'parallel', 'many agents', and 'save time', which can cause the skill to activate in contexts where multi-agent orchestration is unnecessary. Unintended invocation can expand access to files, scripts, and delegation pathways, increasing the chance of unsafe automation or data exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document includes Chinese phrases such as "省时间", "不用省 token", and "多多多派" as intent examples, but it does not state that users may use other languages or that the policy is specifically intended for a Chinese-language environment. This can be interpreted as a language-specific policy assumption without explicit user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The description explicitly enumerates Chinese and English trigger phrases for invocation, which bakes locale-specific behavior into the skill definition. There is no statement that language choice is configurable or user-selected, which can violate language/locale neutrality expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.